OT Cybersecurity for IT Professionals: 5 Things OT Wants IT to Know
Summary: Dragos Principal Industrial Consultant Mike Hoffman argues that IT and OT have converged over the last 20 years but should not merge into a single mission, and that applying IT security controls to OT requires a different mindset. He says OT uptime must be measured in years rather than months, that low latency is measured in milliseconds and microseconds on an assembly line, and that OT risk should be framed as consequence times threat times vulnerability, drawing on process hazard analysis and failure mode and effects analysis.
What's compelling: If your risk model scores OT systems the way it scores laptops, it will miss the physical consequence the source puts at the center of the equation - and the crown jewel analysis that identifies which ICS assets actually drive that consequence is a process IT teams typically do not run.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026